CaryvaneHelp
/

Deploy the agent

The agent is a service that runs on the machine being backed up. It enrols itself into one customer using a deployment token, checks in to the console, and does the work. One installer per platform; the token is the only thing that differs per customer.

Before you start

You need a deployment token for the customer this machine belongs to. Tokens are single-use by default and expire (24 hours unless you chose otherwise), so create it when you are ready to install. The machine needs outbound HTTPS (443) to console.caryvane.com; nothing inbound.

Windows #

Windows 10/11 and Server 2016 or later, x64 or ARM64. Two installers ship for each: a Setup EXE for double-click and hand installs, and the MSI inside it for Intune, SCCM, RMM and scripts. Both are code-signed, and so is every binary they install.

Silent install with a token (RMM, Intune, scripts) #

The console writes this command for you when you create a token — Agents → Enroll Agent — with the current MSI URL and the token filled in. It is the MSI, run quietly:

msiexec /i "https://console.caryvane.com/downloads/agent/CaryvaneAgent-x64.msi" /quiet AURAWOLF_SERVER=https://console.caryvane.com AURAWOLF_TOKEN=<token>

Or the Setup EXE, which accepts the same two values and runs the MSI for you:

CaryvaneAgentSetup-x64.exe /SP- /VERYSILENT /NORESTART /server="https://console.caryvane.com" /token="<token>"

Use the arm64 build on ARM devices (Surface Pro X, Snapdragon laptops); the x64 build will refuse to install there.

Run it elevated

The installer registers a Windows service and writes to Program Files; an RMM that runs as SYSTEM is ideal. A token that has already been used, or has expired, leaves the agent installed but not enrolled — it then waits for enrolment from the tray icon, and shows in no console until that happens.

Interactive install #

  1. Download the Setup EXE from the console (Agents → Enroll Agent shows the link) and run it. It installs the service, the tray application and — if any cloud drive is ever mounted — the Dokany driver it needs.
  2. Enrol from the tray icon. Right-click the Caryvane icon in the notification area → Enroll Agent… → paste the deployment token → Connect. The status changes to enrolled within a few seconds.
  3. Confirm in the console. Agents lists the machine under the customer the token belonged to, Online, with its version. If it is not there after a minute, see Agent installed but not in the console.

What goes where #

WhatWhere
Service and tray binariesC:\Program Files\Caryvane\Caryvane Agent\
Windows serviceCaryvaneAgent (runs as SYSTEM)
Enrolment token, local database, drive cacheC:\ProgramData\Aurawolf\
LogsC:\ProgramData\Aurawolf\logs\agent.log
Server URL and token from an MSI installHKLM\SOFTWARE\Centurion Computers\Aurawolf Agent

The Aurawolf names are the product's original name and are correct; they were kept on disk deliberately so that upgrades never orphan a machine's enrolment.

Upgrades and uninstall #

Agents update themselves: when a new version is published the agent downloads it on its next check-in, stops, installs and restarts. Nothing in ProgramData is touched by an upgrade — the machine stays enrolled, keeps its drives and its job history.

A real uninstall (Add or Remove Programs, or msiexec /x) removes the enrolment, the local database and the drive cache as well as the program, so a later reinstall starts clean and enrols afresh. Logs are kept. A machine whose enrolment is deliberately discarded this way disappears from the console's Online list and its agent row can be deactivated there.

macOS #

macOS 13 or later; Apple silicon and Intel builds, both notarised. The agent runs as a LaunchDaemon (com.caryvane.agent).

  1. Install the package. Double-click CaryvaneAgent-arm64.pkg (or -x64), or unattended:
    sudo installer -pkg CaryvaneAgent-arm64.pkg -target /
  2. Give it the token. For an unattended install place the token before running the package (the daemon reads it on first start), or afterwards and restart:
    sudo mkdir -p "/Library/Application Support/Caryvane"
    echo '{"DeploymentToken":"<token>"}' | sudo tee "/Library/Application Support/Caryvane/setup.json" >/dev/null
    sudo launchctl kickstart -k system/com.caryvane.agent
  3. Grant Full Disk Access. Required — running as root is not enough on macOS. System Settings → Privacy & Security → Full Disk Access, add /Applications/Caryvane.app. Under MDM, push a PPPC profile that grants SystemPolicyAllFiles to the app's bundle identifier; without it the agent can see only its own files and every backup reports the source as empty.
  4. Check it. sudo launchctl print system/com.caryvane.agent | head shows it running; the console shows it Online.
WhatWhere
Application (daemon, menu bar, FSKit drive module)/Applications/Caryvane.app
Token, database, cache/Library/Application Support/Caryvane/
Daemonsystem/com.caryvane.agent
Time Machine-style exclusions

The agent deliberately skips macOS system volumes, ~/Library caches and the AppleDouble ._* sidecars that the Finder writes to non-native filesystems, so a Mac backup contains the user's data rather than a copy of macOS.

Linux #

Debian/Ubuntu (.deb) and RHEL/Fedora/Rocky (.rpm), x86-64 and aarch64, systemd required. The service is caryvane-agent.

# Debian / Ubuntu
sudo apt install ./caryvane-agent_<ver>_amd64.deb
# RHEL / Fedora / Rocky
sudo dnf install ./caryvane-agent-<ver>-1.x86_64.rpm

# Enrol (the file is a conffile: upgrades never overwrite it)
echo '{"DeploymentToken":"<token>"}' | sudo tee /etc/caryvane/agent.json >/dev/null
sudo systemctl restart caryvane-agent
sudo journalctl -u caryvane-agent -n 30

State lives in /var/lib/caryvane. Cloud drives on Linux mount through FUSE (fuse3 is a package dependency). The agent updates itself through the package manager it was installed with, so apt/dnf history shows every version it has run.

Verify the enrolment #

In the console, Agents → find the machine. Three things to check: it is under the right customer (the token decides this, and it cannot be moved afterwards without re-enrolling), it is Online (it checks in continuously; a machine not heard from for 90 seconds shows offline), and the version matches the current release. Then create its first backup job.

Moving a machine to another customer or server #

An enrolment is one machine ↔ one customer ↔ one server. To change any of those: uninstall (which forgets the enrolment), reinstall with a token for the new customer. On a machine that was enrolled against a server it can no longer reach — a pilot environment, say — the current agent notices the server's rejection, discards the dead enrolment itself and asks for a new token from the tray; installing the current version over the top is enough to trigger that.

Do not copy token.json between machines

The token is bound to the machine's hardware fingerprint. A copied token is refused, and the copying machine ends up enrolled as nothing.